registry  /  power-claude  /  3.0.77

power-claude@3.0.77

⚠ Under review

Local orchestration for Claude Code — session recovery, scheduling, worktrees, Token Saver, and dashboards via official CLI transport. Independent third-party software. Free to start.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 4 file(s), 1.68 MB of source, external domains: api.anthropic.com, neural-llm.com
Oversized source lightweight scan
bin/power-claude-cli.js2.47 MB file, sampled 256 KB
FilesystemDynamicRequireObfuscatedHighEntropyStringsMinified
out/extension.js5.63 MB file, sampled 256 KB
CryptoDynamicRequireObfuscatedHighEntropyStringsMinified

Source & flagged code

10 flagged · loading source
package.jsonView file
•scripts.postinstall = bash scripts/release/merge-drivers/register.sh
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = bash scripts/release/merge-drivers/register.sh
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/power-claude-proxy.jsView file
1#!/usr/bin/env node L2: 'use strict';const _0x540249=_0x5e20;(function(_0x2e7bc7,_0x3ffd86){const _0x31fb3c=_0x5e20,_0x29b0f8=_0x2e7bc7();while(!![]){try{const _0x116ec9=-parseInt(_0x31fb3c(0x22f9,'XAVL')...
High
Child Process

Package source references child process execution.

bin/power-claude-proxy.jsView on unpkg · L1
1#!/usr/bin/env node L2: 'use strict';const _0x540249=_0x5e20;(function(_0x2e7bc7,_0x3ffd86){const _0x31fb3c=_0x5e20,_0x29b0f8=_0x2e7bc7();while(!![]){try{const _0x116ec9=-parseInt(_0x31fb3c(0x22f9,'XAVL')...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/power-claude-proxy.jsView on unpkg · L1
bin/power-claude-rotator.jsView file
1#!/usr/bin/env node L2: 'use strict';const _0x272155=_0x330b;(function(_0xc39971,_0x4e35f0){const _0x21ccf6=_0x330b,_0x4853c1=_0xc39971();while(!![]){try{const _0x56f87c=-parseInt(_0x21ccf6(0x28c,'Aar@'))...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/power-claude-rotator.jsView on unpkg · L1
1#!/usr/bin/env node L2: 'use strict';const _0x272155=_0x330b;(function(_0xc39971,_0x4e35f0){const _0x21ccf6=_0x330b,_0x4853c1=_0xc39971();while(!![]){try{const _0x56f87c=-parseInt(_0x21ccf6(0x28c,'Aar@'))...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/power-claude-rotator.jsView on unpkg · L1
data/vendor/jq/jq-darwin-amd64View file
•path = data/vendor/jq/jq-darwin-amd64 kind = native_binary sizeBytes = 851328 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

data/vendor/jq/jq-darwin-amd64View on unpkg
data/runtime/engine.encView file
•path = data/runtime/engine.enc kind = high_entropy_blob sizeBytes = 491749 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/runtime/engine.encView on unpkg
bin/power-claude-cli.jsView file
•path = bin/power-claude-cli.js kind = oversized_source_file sizeBytes = 2591344 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/power-claude-cli.jsView on unpkg
•path = bin/power-claude-cli.js kind = oversized_cli_entrypoint sizeBytes = 2591344 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/power-claude-cli.jsView on unpkg

Findings

7 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/power-claude-proxy.js
HighCommand Output Exfiltrationbin/power-claude-proxy.js
HighObfuscated Payload Loaderbin/power-claude-rotator.js
HighObfuscated
HighShips High Entropy Blobdata/runtime/engine.enc
HighOversized Source Filebin/power-claude-cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/power-claude-rotator.js
MediumNetwork
MediumShips Native Binarydata/vendor/jq/jq-darwin-amd64
MediumOversized Cli Entrypointbin/power-claude-cli.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License